CVE-2011-3207: Medium severity openssl vulnerability
crypto/x509/x509vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.
Other sources
From the upstream advisory [1]:
Under certain circumstances OpenSSL's internal certificate verification routines can incorrectly accept a CRL whose nextUpdate field is in the past. (CVE-2011-3207)
This issue applies to OpenSSL versions 1.0.0 through 1.0.0d. Versions of OpenSSL before 1.0.0 are not affected.
Users of affected versions of OpenSSL should update to the OpenSSL 1.0.0e release, which contains a patch to correct this issue.
Thanks to Kaspar Brand <ossl> for identifying this bug and suggesting a fix.
Applications are only affected by the CRL checking vulnerability if they enable OpenSSL's internal CRL checking which is off by default. For example by setting the verification flag X509VFLAGCRLCHECK or X509VFLAGCRLCHECKALL. Applications which use their own custom CRL checking (such as Apache) are not affected.
[1] http://www.openssl.org/news/secadv20110906.txt
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3207?
CVE-2011-3207 is considered a high-severity vulnerability due to the potential for remote attackers to bypass certificate revocation list (CRL) validation.
How do I fix CVE-2011-3207?
To fix CVE-2011-3207, upgrade OpenSSL to version 1.0.0e or later.
What software is affected by CVE-2011-3207?
CVE-2011-3207 affects OpenSSL 1.0.x versions prior to 1.0.0e.
Can CVE-2011-3207 be exploited remotely?
Yes, CVE-2011-3207 can be exploited remotely, allowing attackers to bypass security mechanisms.
What are the implications of CVE-2011-3207?
The implications of CVE-2011-3207 include the risk of using compromised or invalid certificates due to failed CRL validations.